package com.online.shopping.common.filter;

import com.online.shopping.common.utils.JwtTokenUtil;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;

// 检测用户访问资源的合法身份
public class JwtAuthorizationFilter extends OncePerRequestFilter {

	@Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
		// 首先获取请求头中的token(JWT)
		String tokenHeader = request.getHeader("authorization");
		System.out.println("tokenHeader = "+tokenHeader);

		if(tokenHeader!=null && tokenHeader.startsWith(JwtTokenUtil.TOKEN_PREFIX)){
			UsernamePasswordAuthenticationToken token = getAuthentication(tokenHeader);
			// 将token放到SecurityContext（springsecurity的上下文）中
			SecurityContextHolder.getContext().setAuthentication(token);
		}

		// 放行
		filterChain.doFilter(request,response);
	}

	// 检测token的有效性
	public UsernamePasswordAuthenticationToken getAuthentication(String tokenHeader){
		String token = tokenHeader.replace(JwtTokenUtil.TOKEN_PREFIX,"");
		String username = JwtTokenUtil.getProperties(token);
		System.out.println("username = "+username);

		if(username != null){
			return new UsernamePasswordAuthenticationToken(username,null,new ArrayList<>());
		}
		return null;
	}
}
